medium5.3Public exploit code
CVE-2018-20523
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Xiaomi browser 10.2.4.g - Browser Search History Disclosure2021-08-10 · local · android
Impact
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mi | Stock Browser | Version 10.2.4g |
| Mi | Redmi 7 Firmware | All versions |
| Mi | Redmi Note 7 Firmware | All versions |
| Mi | Redmi Note 6 Pro Firmware | All versions |
| Mi | Redmi 6 Firmware | All versions |
| Mi | Redmi 6a Firmware | All versions |
| Mi | Redmi S2 Firmware | All versions |
| Mi | Redmi Note 5 Pro Firmware | All versions |
| Mi | Redmi K20 Pro Firmware | All versions |
| Mi | Redmi K20 Firmware | All versions |
| Mi | Redmi 7a Firmware | All versions |
| Mi | Redmi Go Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html
- https://sec.xiaomi.com
- https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser
- http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html
- https://sec.xiaomi.com
- https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser